Malicious AI browser extensions: fake AI sidebars copied users' chatbot conversations

What happened

On December 30, 2025, OX Security reported two malicious AI browser extensions in the Chrome Web Store. According to OX, both posed as a legitimate AI sidebar extension that lets users chat with popular AI models from any web page, and both copied the legitimate tool’s interface so they appeared to work normally.

OX says the extensions asked users for consent to collect “anonymous, non-identifiable analytics data,” but instead captured full ChatGPT and DeepSeek conversations, including prompts and responses, along with the URLs of all open Chrome tabs. It says the data was stored locally and sent to a remote command-and-control server every 30 minutes. OX describes the reach as “over 900,000 Chrome extension downloads,” listing one extension at more than 600,000 users and the other at more than 300,000. It says the larger one carried Google’s “Featured” badge.

OX says it reported both extensions to Google on December 29, 2025. As of December 30, it says, Google had responded that the issue was in review, and both extensions were still available, with the first still carrying its “Featured” badge. OX notes that the stolen conversations could include source code, business plans, personal information, and confidential communications, and that tab URLs can include session tokens and internal corporate addresses.

Why it matters to leaders (our analysis)

Whatever employees type into an AI chat in the browser can be read by any extension with broad page access. In this case the extensions looked like useful AI tools, worked as advertised, and one had a store badge that signals quality, not security. The data at risk is whatever staff chose to share with an AI assistant, which can be a lot.

The controls are mostly existing browser management: allow-listing, permission review, and monitoring. Giving staff an approved AI tool also reduces the pull toward consumer add-ons.